SkillSpector

SkillSpector is a security scanner for AI agent skills, the SKILL.md bundles used by Claude Code, Codex CLI, Gemini CLI, and similar agents. It answers whether a skill is safe to install by scanning a Git repository, URL, zip file, directory, or single file for vulnerabilities, malicious patterns, and supply-chain risks. It is part of the NVIDIA Verified Skills pipeline, which scans, evaluates, and signs skills before publishing them to the NVIDIA skills catalog. The motivation comes from a study of 42,447 marketplace skills in which 26.1% of the analyzed subset contained a vulnerability and 5.2% showed likely malicious intent.

Detection runs in two stages. Stage one is static: regex matching across 11 analyzers, AST analysis of dangerous calls, taint tracking, YARA signatures, and live CVE lookups of declared dependencies against OSV.dev with an offline fallback list. It covers 71 patterns in 17 categories, including prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, excessive agency, memory poisoning, tool misuse, rogue agent, trigger abuse, MCP least privilege, and MCP tool poisoning. Stage two is optional LLM semantic analysis of file contents, which can raise a finding's confidence and add an explanation but never removes a deterministic finding. Unconfirmed findings are tagged in JSON and SARIF output, and the prompt carries anti-jailbreak protections.

Findings roll up into a 0 to 100 risk score (CRITICAL +50, HIGH +25, MEDIUM +10, LOW +5, with a 1.3x multiplier for executable scripts) that maps to SAFE, CAUTION, or DO NOT INSTALL. The exit code and JSON report are a stable contract for CI pipelines, install gates, and editor integrations, with strict gates for any active finding, incomplete coverage, or a coverage floor. A baseline file suppresses accepted findings so re-scans report only new issues, and an MCP registry mode compares snapshots of server identities and normalized fields.

The LLM stage works with OpenAI, Anthropic (direct, through a Vertex-style proxy, or on AWS Bedrock), NVIDIA build.nvidia.com, Gemini on Google Cloud, Azure OpenAI, Ollama, any OpenAI-compatible endpoint, or the local Claude, Gemini, and OpenCode CLIs using their own login sessions. Structured output goes through LangChain, and the analysis is a LangGraph workflow that the Python API exposes directly. An MCP server exposes a single scan_skill tool so MCP-capable agents can gate skill and MCP installs on the verdict, and extensions install it inside Pi and OpenCode sessions. The scanned skill is never executed.